3Com OfficeConnect ADSL Router DHCP Response Information Disclosure Vulnerability
BID:7592
Info
3Com OfficeConnect ADSL Router DHCP Response Information Disclosure Vulnerability
| Bugtraq ID: | 7592 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 14 2003 12:00AM |
| Updated: | May 14 2003 12:00AM |
| Credit: | This vulnerability was reported by "David F. Madrid" <[email protected]>. |
| Vulnerable: |
3Com OfficeConnect DSL Router 812 1.1.9 3Com OfficeConnect DSL Router 812 1.1.7 |
| Not Vulnerable: | |
Discussion
3Com OfficeConnect ADSL Router DHCP Response Information Disclosure Vulnerability
A problem with the OfficeConnect routers may make it possible for attackers to view potentially sensitive information. The vulnerability exists due to a flaw in the way memory is initialized when responding to certain requests. Specifically, when DHCP requests are initiated by clients, the router fails to properly initialize memory buffers which may result in the leakage of potentially sensitive information.
Additional reports indicate that the 1.1.9 firmware is also affected.
A problem with the OfficeConnect routers may make it possible for attackers to view potentially sensitive information. The vulnerability exists due to a flaw in the way memory is initialized when responding to certain requests. Specifically, when DHCP requests are initiated by clients, the router fails to properly initialize memory buffers which may result in the leakage of potentially sensitive information.
Additional reports indicate that the 1.1.9 firmware is also affected.
Exploit / POC
3Com OfficeConnect ADSL Router DHCP Response Information Disclosure Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
3Com OfficeConnect ADSL Router DHCP Response Information Disclosure Vulnerability
Solution:
It should be noted that this product is discontinued.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
3Com OfficeConnect DSL Router 812 1.1.7
Solution:
It should be noted that this product is discontinued.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
3Com OfficeConnect DSL Router 812 1.1.7
-
3Com OfficeConnect 812 & 840 1.1.9.4
ftp://ftp.3com.com/pub/officeconnect/ocradsl/bld_1_1_9_4.zip